Insufficient Entropy vulnerability on Multiple Products (Schneider Electric Easergy MiCOM C264)
En bref
- Source
- NVD
- EPSS
- EPSS 0.31 % · centile 24 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- schneider
- Statut NVD
- Awaiting Analysis
Rechercher sur…
Description
CWE‑331: Insufficient Entropy vulnerability exists that could lead to unauthorized access when an attacker on the network can exploit weaknesses in session‑management protections.
Faiblesses (CWE)
- CWE-331 — Entropie insuffisante
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 4.0 | HIGH 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N | schneider |
| CVSS 4.0 | HIGH 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD · cybersecurity@se.com (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2026-29459
- GCVE · GCVE-0-2026-4827
Avis du CERT-FR
- CERTFR-2026-AVI-0566 — Multiples vulnérabilités dans les produits Schneider Electric · cert.ssi.gouv.fr
Produits affectés
| Produit | Versions |
|---|---|
| Schneider Electric · Easergy MiCOM C264 | affected Versions D6.x ; affected Versions D7.33 and prior |
| Schneider Electric · Easergy C5 | affected Version 1.1.17 and prior |
| Schneider Electric · Easergy MiCOM P30 | affected P139 version prior to P139.678.700 ; affected P437 version prior to P437.678.700 ; affected P439 version prior to P439.678.700 ; affected P532 version prior to P532.678.700 ; affected P539 version prior to P539.678.700 ; affected P631 version prior to P631.678.700 |
| Schneider Electric · Easergy MiCOM P40 | affected Series model numbers with Protocol Option bit as G, H or L and all firmware versions |
| Schneider Electric · EcoStruxure™ Power Automation System Gateway (EPAS-GTW) | affected Version 6.4.616.200.100 and prior |
| Schneider Electric · EcoStruxure™ Power Automation System User Interface (EPAS-UI) | affected Version 3.0.3 and prior |
| Schneider Electric · EcoStruxure™ Power Operation | affected Version 2022 CU6 and prior ; affected Version 2024 CU2 and prior |
| Schneider Electric · iPMFLS | affected Version 64.2025.0.13 and prior |
| Schneider Electric · PowerLogic™ P5 Protection Relay | affected V02.502.103 and prior |
| Schneider Electric · PowerLogic™ P7 Protection and Control Platform | affected V02.002.002 and prior |
| Schneider Electric · PowerLogic™ T300 | affected Version 2.9.4 and prior |
| Schneider Electric · PowerLogic™ T500 | affected Version 11.08.02 and prior |
| Schneider Electric · Saitel DP | affected Version 11.06.36 and prior |
| Schneider Electric · EasyLogic T150 (formerly Saitel DR) | affected Version 11.06.30 and prior |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |